step 1 : 生成server key
使用java/kegtool工具
keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore e:/server.keystore -validity 3600
注:參數(shù) -validity 指證書的有效期(天)，缺省有效期很短，只有90天。

step 2 : 將證書導(dǎo)入java證書信任庫,服務(wù)端和客戶端都必須導(dǎo)入證書
分2步,第一步導(dǎo)出證書,第二步導(dǎo)入信任庫(tomcat為證書別名)
keytool -export -trustcacerts -alias tomcat -file server.cer -keystore e:/server.keystore -storepass changeit
keytool -import -trustcacerts -alias tomcat -file server.cer -keystore E:/Java/jdk1.6.0_03/jre/lib/security/cacerts -storepass changeit
其他有用的keytool命令
列表:keytool -list -v -keystore E:/Java/jre1.6.0_03/lib/security/cacerts
刪除:keytool -delete -trustcacerts -alias tomcat -keystore E:/Java/jdk1.6.0_03/jre/lib/security/cacerts -storepass changeit
注:E:/Java/jdk1.6.0_03/jre/lib/security/cacerts的JRE路徑和tomcat設(shè)置的E:\Java\jdk1.6.0_03\jre\bin\client\jvm.dll路徑相同

step 3 : 配置tomcat server.xml,服務(wù)端和客戶端都必須配置
tomcat6.0加入以下xml代碼
<Connector protocol="org.apache.coyote.http11.Http11Protocol"
           port="8443" minSpareThreads="5" maxSpareThreads="75"
           enableLookups="true" disableUploadTimeout="true"
           acceptCount="100"  maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="e:/server.keystore" keystorePass="changeit"
           clientAuth="false" sslProtocol="TLS"/>
 
參考:http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html